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Monitoring ISDN links 
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Technical Field 

This invention relates to monitoring systems which collect data from an Integrated 
J Services Digital Network (ISDN). 

Background 

The Integrated Services Digital Network has been designed to provide customers 
with digital access to the pubUc network, which can carry a mmiber of different services 

10 at a range of different bandwidths. The narrowband ISDN is extensively deployed 
worldwide. The broadband ISDN (B-ISDN) is in early deployment and trial phases with 
a number of operators. The network that operators will actually have to manage will be a 
combination of existing digital and analogue networks, narrowband ISDN, broadband 
ISDN, intemet technology and other technologies. A specific service is likely to use 

15 resources from a number of these different networks (Figure 2 shows some examples of 
the resources and technologies involved). This presents major problems in the end-to-end 
management of the service. The monitoring system described here addresses many of 
these problems. 



20 Disclosure of Invention 

According to one aspect of this invention there is provided a method of 
monitoring an ISDN link, comprising the steps of: monitoring at a first location 
subscriber signalling messages on an ISDN D channel to derive first monitoring data; 
monitoring at said first location telecommunications traffic traversing ISDN B channels 

25 associated with said ISDN D chaimel to derive second monitoring data; and correlating 
said first and second monitoring data. 

In some case it may be desirable to monitor additional signalling messages (e.g. 
SS7 protocol messages) on a signalling link in a teleconraiunications network (such as the 
public switched telephone network - PSTN) coupled to said ISDN link, to derive third 

50 monitoring data, and correlate those third monitoring data with at least one of the first and 
second monitoring data. Another option is to monitor signalling messages and 
telecommunications traffic on ISDN links at a second location, and correlate the resulting 
monitoring data with those first and second monitoring data. 

According to another aspect of this invention there is provided a method of 

35 monitoring an ISDN link, comprising the steps of: monitoring subscriber signalling 
messages on an ISDN D channel to derive fiist monitoring data; monitoring additional 
signalling messages (e.g. SS7 protocol messages) on a signalling link in a 
telecommunications network coupled to said ISDN link, to derive second monitoring 
data; and correlating said first and second monitoring data. 
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According to a further aspect of this invention there is provided apparatus for 
monitoring an ISDN link, comprising: first equipment at a first location for monitoring 
subscriber signalling messages on an ISDN D channel to derive first monitoring data; 
second equipment at said first location for monitoring telecommimications traffic 
5 traversing ISDN B channels associated v^^ith said ISDN D channel to derive second 
monitoring data; and correlation apparatus coupled to said first and second equipment to 
receive and correlate said first and second monitoring data. 

According to another aspect of this invention there is provided apparatus for 
monitoring an ISDN link, comprising the steps of: first equipment for monitoring 
10 subscriber signalling messages on an ISDN D channel to derive first monitoring data; 
second equipment for monitoring additional signalling messages (e.g* SS7 protocol 
messages) on a signalling link in a telecommunications network coupled to said ISDN 
link, to derive second monitoring data; and correlation apparatus coupled to said first and 
second equipment to receive and correlate said first and second monitoring data. 

15 

Brief Description of Dravyings 

Methods and apparatus in accordance with this invention for monitoring ISDN 
hnks Mdll now be described, by way of example, with reference to the accompanying 
drawings, in which: 
20 Figure 1 shows a distributed ISDN monitoring system; 

Figure! shows examples of local loop and core network probe 
measurements which may be correlated to create end-to-end service 
records; and 

Figure 3 shows one exemplary architecture for combined monitoring of an 
25 ISDN and an SS7 signalling system. 

Best Mode for Carrying Out the Invention, & Industrial Applicability 

The distributed monitoring system shown in the drawings has the capability to 
collect data from an ISDN, correlate these data in real-time, and provide a real-time view 

30 of services on the network. These data can be used for applications such as 
troubleshooting, surveillance, security, network planning, provision of accounting 
information to customers, firaud detection, billing and marketing information. The 
monitoring system can be used to monitor multiple ISDNs which may be interconnected 
by other technologies, such as internet protocol (IP) networks. Part of the ISDNs may be 

35 made up of older technologies, such as analogue. 

Referring to Figure 1, the probes shown are part of a distributed monitoring 
system, and may be implemented as either link monitoring devices (using techniques 
similar to those in existing protocol analysers for example) or as software and hardware 
on network elements (such as nodes and switches). The distributed monitoring system is 
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constructed from the probes and standard computer and commimications components, 
with specialised software which provides the applications described above. A principal 
function of this specialised software is to correlate data from different probes to provide a 
record or real-time trace of calls, transactions and other services as they occur on the 
5 network. The Hewlett-Packard acceSS? system is an example of a distributed monitoring 
system which could be used to implement parts of the system described above. 

According to this invention monitoring of the local loop is also provided, in 
respect of subscriber signalling and the services themselves (for example the content of 
the B channels of primary rate access (PRA) or basic rate access (BRA) ISDN); 
10 furthermore data from any of the probes covering any of the technologies in the local loop 
or core network (see Figure 2) may be correlated (e.g, data fium a probe for any local 
loop protocol at one end of the service, plus data from a probe for any core network 
protocol, plus data from a probe for any local loop protocol at the other end of the 
service). 

15 An example of a monitoring system architecture is given in Figure 3. This shows 

probes passively monitoring both the SS7 network and the PRA ISDN. The SS7 passive- 
monitoring probes could be for example from the Hewlett-Packard acceSS? system. The 
ISDN primary rate access probes could for example be constructed using the same 
techniques as in existing protocol analysers (such as the Hewlett-Packard 37900D 

20 Signalling Test Set). 

According to this invention the distributed monitoring system is arranged to 
correlate real-time data from any combination of these probes. This includes, for 
example, the D channel and B channel of ISDN PRA and the signalling miits from SS7. 

The invention can be appUed in respect of other protocols and technologies in the 

25 access network. An important example is the use of remote digital terminals to 
concentrate a number of different local loop technologies to a common interface. The 
local loop technologies supported are: traditional analogue connections, ISDN primary 
rate and basic rate, various copper-pair based high-speed digital subscriber loop 
technologies (e.g. ADSL, HDSL), "Fibre in the Loop" and wireless technologies. The 

30 ITU-T V5 specification and the Bellcore GR-303 series of specifications are examples of 
architectures used to concentrate the subscriber loop technologies. Probes can be 
constructed which monitor the connection between the digital terminal and the local 
switch (e.g. the V5 or GR-303 protocol), using technologies already available for protocol 
analyser products such as the HP 37900D. The probes can determine the signalling 

35 protocol on the connection, and monitor the bearer channels, in a similar way to the ISDN 
monitoring architecture shown in Figure 3. This data source should be considered part of 
the distributed monitoring system for the following discussion. Service usage data can be 
obtained from this source in a similar way as for ISDN, but for a broader range of 
subscriber loop technologies. 
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For convenience the invention is described primarily with reference to 
narrowband ISDN and its associated B (bearer) channels and D (data) channel. However, 
it should be understood that this terminology is to be taken as including within its scope 
channels with analogous functionality in broadband ISDN systems, such as asynchronous 
5 transfer mode (ATM) systems, whether or not they are customarily identified by these 
terms. 

The analogue of the D channel in the broadband ISDN is a predefined virtual 
channel called the Signalling Channel. In the case of non-associated mode signalling this 
channel is identified by Virtual Path Identifier (VPI) = 0 and Virtual Channel Identifier 

10 (VCI) = 5, In the case of associated mode signalling there is an independent signalling 
channel for each virtual path that is using associated signalling. This signallmg channel 
has the same VPI as the virtual path and VCI = 5. 

The analogue of the B channel in the broadband ISDN is a dynamically assigned 
virtual channel (sometimes called a Switched Virtual Circuit or SVC), which is set up 

15 using messages on the signalling channel, and which carries the communication traffic 
between the two communicating endpoints. This can be identified by capturing and 
decoding of the relevant signalling messages on the signalling channel, as described in 
more detail later. 

20 GENERATION OF SERVICE RECORDS 

This section lists the types of fields in various examples of service records, and 
describes how the distributed monitoring system could provide the required data. A 
service record is generated for each instance of the usage of a specific service. This is a 
generaUsation of a call record, which is generated by current switches. A service is 
25 normally defined firom the perspective of the user. The service may actually involve a 
number of calls or transactions, for example. The service records described here correlate 
together these different calls and transactions, using information fi-om the SS7 and ISDN 
signalling information, to provide a single record of the service. 

30 1. Calling Party Information, 

This includes any information which can be derived about the calling party firom 
the data flowing on the hnks of the Integrated Services Digital Network, and is therefore 
available to the link monitoring probes. Typical information includes: calling party 
number; any ISDN sub-addressing information; calling party name; X.25 or firame relay 

35 addresses; other network addresses; and any numbers or addresses related to billing. 

This information may be derived firom: call setup messages on the ISDN D 
channels, at either the originating or terminating end or both; and/or firom call setup 
messages on any of the SS7 links. Additional information may be derived from the ISDN 
B chaimel for certain services such as frame relay. In this case the headers of the frames 
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contain addressing information. Additional information may also be derived from any 
intelligent network services messages which flow over the SS7 links as part of the 
specific service usage. Further information may be derived from looking at the ISDN B 
or D channels of any intelligent peripherals involved in the specific service usage. 

5 

2. Called Party Information. 

As for calling party information, but replace calling party by called party. 

3, Network Routing Information. 

10 This may include any information on the network resources which were, used to 

provide this specific service usage. The following are examples of data which might be 
provided: 

- ISDN links and channels used; 

- SS7 links and nodes used; 
15 -trunks used; 

- intelligent network nodes used. 

Each of these uses is time-stamped, and the sequence and nature of the use indicated. 
These data can be obtained in a similar way as was described for item 1 above. 

20 4. IntelUgent Network Services Information. 

This may include any information on intelligent network services used for this 
specific service usage. The following are some examples of the data which may be 
provided: 

- calling party name delivery information; 
25 ' local number portability information; 

- call forwarding information; 

- interactive voice response information on the use of intelligent peripherals; 

- 800 number services. 

This information includes time-stamps, duration and the nature of the use. 
30 These data can be obtained in a similar way as was described for item 1 above. 

5. Service Status and Temiination Information. 

This may include time-stamped information on the initiation of the service, any 
status changes occurring during service and the termination of the service. The 
35 termination information should include the reasons for termination. 

These data can be obtained in a similar way as was described for item 1 above. In 
particular, the call clearing messages on the SS7 links and the ISDN D channels can 
provide details on the reasons for call termination. 
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6. Analysis of B-Chaimel to Distinguish Voice from Fax or Data. 

As part of the process of generating service records, the B-channel associated with 
a particular call can be identified from the signalling messages on the corresponding D- 
channeL The probe monitoring the link carrying the B-channel can be instructed to 
5 capture data from the B-channel. An analysis of the spectrum of this captured data can be 
used to identify the type of service being carried in the B-channeL This could be used for 
distinguishing a voice call from a fax or data call. The probe can be instructed to 
periodically sample the B-channel to check for any change in the type of service being 
used. 

10 

7. Analysis of Tones in the B-Channel to Identify Any Additional Dialled Data. 

The probe may also be instructed to analyse the data captured from the B-chaimel 
to identify any multi-frequency tones (eg DTMF) which may provide fiirther information 
about the call. This may be used to identify any additional digits dialled by the subscriber 
15 after the initial call is connected. These digits can be added to any service record which 
is generated by the monitoring system for the call. It could also used for identifying a fax 
call from the signalling between two fax machines. 

8. Service Type. 

20 This may include information on the following types of services: 

- voice; 

- modem; 

- fax; 

- video; 
25 - X.25; 

- frame relay; 

- ATM (asynchronous transfer mode); 

- LAN interconnection. 

These data can be obtained in a similar way as was described for item 1 above. In 
30 particular, the call establishment messages in the ISDN D channel provide information on 
the type of service. This can be correlated with data taken from the ISDN B channels 
identified in the ISDN D channel signalling. 

9. Service Qualify Information. 

35 The service quality information provided is dependent on the service indicated in 

the service type field. The following gives some examples of what can be provided for 
specific services. 

Voice qualify is mainly indicated by the bit error rate and the delay. These 
parameters can be measured using a passive monitoring system, by using the signalling 
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information to identify the ISDN B channels which are carrying the voice signals. The 
bit streams from each of the B channels identified can be compared to derive the delay 
and bit error rate caused by the intermediate networks. This is particularly important 
where one of the intermediate networks is packet or frame based and cannot guarantee 
5 delivery times (e.g. IP protocol or ATM). 

Video, modem and fax quality can be addressed in a sunilar way. 

The data oriented protocols (X.25, frame relay, ATM and LAN interconnection) 
require additional data. These can again be measured by using SS7 or ISDN signalling 
data from the probes to identify the ISDN channels carrying the protocol. Existing 
10 protocol analysis techniques can be used to provide estimates of parameters like packet 
loss, retransmissions, CRC errors, throughput and packet delay. 

10. Service Usage Information. 

The time of usage data provided by the distributed monitoring system depends on 
15 the specific service. Some examples follow. 

Voice, video and fax services require call duration and allocated bandwidth. 
The data oriented services require data such as total bits, frames and packets in 
each direction. This may be provided for regular time intervals for the duration of the 
service. It may also be broken down into a traffic matrix, where the data protocol has 
20 additional addressing information (such as IP addresses). The data are obtained in a 
similar way as is described for item 9 above. 

11. Security Information. 

A particular instance of service usage may be an attempt to obtain unauthorised 
25 access to resources. The service record includes information which may indicate this 
type of behaviour. This may include information about the duration of call, the way the 
call was terminated and details of the service used. 

An example would be where a modem is used repeatedly to try different 
passwords. The ISDN B channel used is identified from SS7 and ISDN signalling data. 
30 The probes then extract the data from the ISDN B channel, and the system can determine 
the modem protocol to identify behaviour. 

The examples described above focus mainly on narrow band ISDN. However the 
same concepts apply to broadband ISDN and ATM. Variants of the Q.931 protocol are 
35 used in these standards for users to network mterface signalUng (UNI) and network to 
network interface signalling (NNT). These can be monitored in a similar fashion, and 
service records generated from the sequence of messages which control a particular call. 
The concept of channels is replaced by the concepts of virtual paths and virtual channels. 
However, the virtual path and virtual channel associated with a particular call can be 
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identified from the signalling messages, and the probes monitoring the links which carry 
these virtual paths and channels can be instructed to capture the data associated with the 
call and provides an analysis similar to the narrow band case for inclusion in the service 
record which is generated. 

REAL-TIME UPDATES ON SERVICE USE 

The data that populates the service records described in the previous section is 
collected in real-time from the monitoring probes. These data can be provided in real- 
time on remotely connected computers as they becomes available, A user of the 
distributed monitoring system can apply filtering criteria on any of the information 
described in the previous section, to select those instances of service use for which real- 
time updates are required. 

APPLICATIONS 

The following applications can be implemented using the data from the service records 
described above or the real-time service updates. Data from other sources may be used to 
enhance the effectiveness of these applications. 

A. Quality of Service and Service Level Agreements. 

The service records described above can be used to provide service quality 
information on selected customer's service. This can be used to track conformance to 
service level agreements, and be provided to the customer as an additional service. It can 
be provided as periodic reports, or in real-time using the real-time updates described 
above. 

B. Surveillance and Troubleshooting for Network Operations. 

The service records and real-time updates can be used to identify service or 
network faixlts. The information can also be used to troubleshoot the faults. 

C. Fraud Detection. 

The service records and real-time updates can be used to identify potential 
fraudulent use of the network or service. Indications may include excessive use of high 
value services, unusual call termination behaviour and repeated failures to gain access to 
a service. The distributed monitoring system may be used to track the service usage of 
potential high-risk users in real-time. 

D. Security and Hacking Detection 

Potential security threats can be identified by repeated failures to gain access to a 
service. They also may be indicated by successftil access to sensitive services, such as 
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maintenance ports on customer premises equipment (CPE). This type of data is available 
from the service records and the real-time updates. 

E. Billing Data 

5 The service records can be used as a basis for billing which is dependent on any of 

the fields in the service record. This allows, for example, bilUng to be based on the actual 
service quality delivered. It also enables bilUng to reflect the nature and generation of the 
usage of resources on the network, such as intelligent peripherals and databases. 

10 F. Use of B-Channel Data for Bilhng or Billing Verification Purposes. 

In some countries the regulatory requirements for Telecom operators require that 
calls carrying voice have a different tariff to calls carrying data. They also require that 
any access charges between operators depend on whether the call is voice or data, and if it 
is voice there is also a dependency on the final destination for call. The service records 

15 generated by the monitoring system can be used to determine the bill in these cases (and 
similar situations), using the data derived from the B-channel as described in respect of 
items 6 and 7 above. 

G. Customer Accounting Data 
20 The detailed service usage information in the service records can be provided to 

customers for use in their kitemal accounting. This includes the traffic matrix 
information for packet and frame based protocols, which the system derives from the B 
and D ISDN channels. 

25 H. Customer and Telecom Operator Network Plamiing 

The service records can provide detailed information on the use of network 
resources which can be provided to network planning departments within the operator 
and the customer. 

SO SS7 SIGNALLING NETWORKS AND VOICE TRUNK NETWORKS 

1. A Monitoring System to Provide Call Records Containing Data from Both the SS7 
Signalling Network and the Trunk Network. 

A monitoring system such as Hewlett-Packard's acceSS? system can be used to 
generate call (or service) records by monitoring the sequences of messages on the SS7 
35 network. This monitoring system can be extended with probes which monitor the trunks 
which carry the voice path for calls. The trunk carrying the voice path for a particular 
call can be identified from fields with in the SS7 messages (normally the TCIC in the 
lAM). The probe connected to this trunk can then be instructed to capture the data from 
the trunk for analysis in real-time or at a later date. 
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2. Analysis of "Voice Path" to Distinguish Voice from Fax or Data. 

As part of the process of generating service records, the trunk associated with a 
particular call can be identified from the signalling messages on the corresponding SS7 
5 network. The probe monitoring the trunk can be instructed to capture data from the trunk. 
An analysis of the spectrum of this captured data can be used to identify the type of 
service being carried in the call. This could be used for distinguishing a voice call from a 
fax or data call. The probe can be instructed to periodically sample the trunk to check for 
any change in the type of service being used. 

10 

3. Analysis of Tones in the "Voice Path" to Identify Any Additional Dialled Data. 

The probe may also be instructed to analyse the data captured from the trunk to 
identify any multi-frequency tones (eg DTMF) which may provide fiirther information 
about the call. This may be used to identify any additional digits dialled by the subscriber 
15 after the initial call is connected. These digits can be added to any service record which 
is generated by the monitoring system for the call. It could also used for identifying a fax 
call from the signalling between two fax machines. 

4. Use of "Voice Path" Data for Billing Purposes. 

20 In some countries the regulatory requirements for Telecom operators require that 

calls carrying voice have a different tariff to calls carrying data. They also require that 
any access charges between operators depend on whether the call is voice or data, and if it 
is voice there is also a dependency on the final destination for call. The service records 
generated by the monitoring system can be used to determine the bill in these cases (and 

25 similar situations), using the data derived from the "Voice Path" as described above. 

EXAMPLE OF IMPLEMENTATION FOR B-ISDN USING ATM 

A more detailed description of an implementation for a broadband ISDN using 
ATM will now be given. 

30 ATM infrastructure including UNI and NNI signalling, and potential monitor points : the 
probes monitor ATM links which may support a User Network Interface (UNI) of a 
Network Network Interface (NNI), These may be public, private or inter-carrier 
interfaces - section 4.1 of the ITU-T standard Q.2931 "B-ISDN AppUcation Protocols For 
Access Signaling" gives more details of these interfaces. 

35 The probes monitor one or more of the links in the ATM network and have the 

capability to correlate data between them, as indicated in Figure 1 . 

Description of ATM probe including passive optical tap : the ATM probes monitor the 
links by means of an optical power splitter which has been physically inserted into the 
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optical link. This ensures that the probe cannot modify the transmissions on the link. 
The probe takes a percentage of the optical power (typically 10%) and uses this to 
provide a copy of the ATM cells which are being carried by the link. The probe has 
hardware (e.g. processor, memory and input/output interfaces) and software enabling it to 
5 decode the ATM protocol and the higher level protocols being carried over the ATM 
layer. 

The Generation of Service Records (SRs) for Switched Virtual Circuits (SVCs, also 
referred to as calls) : 

10 Step 1 . Configuring the Service Record Collection System. 

Collection criteria are specified for the monitoring system. This may be 
performed by a system administrator, or programmatically by a software application. The 
criteria may include a list of probes which should be instructed to monitor for signalling 
SETUP messages (see section 6.3.1.6 of "Private Network - Network Interface 

15 Specification" Version 1.0 (PNNI 1.0), ATM Forum af.pnni-0055.000, March 1996) 
which match a set of filtering criteria. The filtering criteria identify characteristics of the 
fields in the SETUP message. These will typically require matching to all or part of the 
Calling or Called Party Number Information Element (see section 4.5,11/13 of Q.2931 
referenced above) of the SETUP message. An E. 164 address is the most likely address 

20 type, but other types of addresses, (e.g. Network Service Access Point (NSAP) or private 
numbering plans) could also be supported. 

A second part of the collection criteria may specify which measurements should 
be made on calls which match the filtering criteria. 

A third part of the collection criteria may specify which measurements or call 

25 information should appear in the Service Record generated for that call. 

A fourth part of the collection criteria may specify that a partially complete 
Service Record is sent in real-time at a specific point in the call. 

Step 2. Capture each SETUP message on the SignaUing Channel and match against 

30 filtering criteria. 

Probes which have been instructed to monitor for setup messages will capture all 
setup messages fr^om the Signalling Channel (as explained above, this is identified by VPI 
= 0 and VCI = 5 for non-associated signalling, or VCI = 5 and all VPI for associated 
signalling) and keep those that match the filtering criteria. A time stamp is also generated 

35 at the time of capture and stored with the SETUP message. 
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Step 3. For each setup message which matches the filtering criteria, create a Service 
Record (SR) and populate with information firom the SETUP message. 

Any of the information elements in the SETUP message can be decoded and 
analysed and the information used to populate the SR. The time stamp associated with 
5 the SETUP message is also stored in the SR. 

Step 4. Identify the Virtual Circuit Associated with the Call. 

The SETUP Message or subsequent signalling messages which are part of the 
same call may carry information which identifies the virtual circuit which will carry the 

10 communications associated with the call Typically the Connection identifier information 
element call for the SETUP message will identify the VPCWCI for the virtual circuit. 
However, this information may be carried in a subsequent CALL PROCEEDING 
message. In this case the Call Reference information element (section 4.3 of Q.2931) 
fi-om the SETUP message is extracted, and the probe is instructed to capture any CALL 

75 PROCEEDING message (section 6.3.1.2 of PNNI 1.0) which has the same Call 
Reference value. Care is needed to distinguish between calls in opposite directions, 
which may use the same Call Reference - the 'call reference flag' is used to do that. The 
VPCI/VCI for the virtual circuit can then be identified fi-om the CALL PROCEEDING 
message. 

20 

Step 5. Identify the Virtual Circuit Associated with the Call At Other Monitoring Points. 

Any probe on a link which carries a given SVC will capture the SETUP message 
and start to generate a service record for that SVC. This problem with duplicate service 
records can be avoided by configuring the monitoring system (in step 1) to only capture 

25 SETUP messages at ingress links (or only at egress links). However, certain 
rneasurements are made possible if two measurements points are available; this is 
particularly useful where the ingress and egress points are monitored. 

The SETUP messages corresponding to the same SVC will have the same Calling 
and Called Party Number information elements. This information is sent to a common 

30 correlation point firom where the probes can be instructed to make two point 
measurements in real-time. Altematively the Calling and Called Party Number 
Information in the service records can be used at a later point to combine service records 
for the same call into a single record. Two point measurements such as cell loss can be 
computed as part of this process. 

35 

Step 6. Perform Quality of Service Measurements On the Virtual Circuit. 

Single point measurements — an example of a single point measurement which 
can be performed once the virtual circuit carrying the communication has been identified, 
is throughput analysis. The number of bytes or cells transmitted is measured at a number 
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of time intervals during the call. The distribution of throughput (in bytes per second for 
example) can be computed. A broad distribution indicates significant fluctuations in 
throughput. This would cause problems for any application which requires constant 
throughput. 

Other examples of single point measurements are computation of the call setup 
time and the measurement of the application response time for higher level protocols such 
as TCP/IP. 

Two point measurements ~ a simple example of a two point measurement is to 
count the number of cells transmitted on the virtual ckcuit at the two monitoring points. 
The difference between the two numbers will give the cell loss. This measurement can be 
made for the call as a whole, or at time intervals during the call. 

Other examples of two point measiurements are measurements of the delay 
variation between cells, between the two measurements points. 

These quality of service measiuiements can be included in the service record for 
the call, or used to produce overall statistics for the quality of service provided by the 
network. 

Step 7. Perform Usage Measurements On the Virtual Circuit. 

Usage measurements are computed at a single point. Simple examples are the 
counts of the bytes, cells or protocol data units. These may be stored as part of the 
service record for the call. More complex measurements, such as traffic matrices for the 
higher level protocols, may be stored as separate records associated with the call. An 
important example is the generation of IP flow records for calls which carry IP traffic. 
This may be used to provide a real-time stream of IP flow records to other ^plications. 

Step 8. Monitor the signalling virtual channel continuously for RELEASE messages 
corresponding to the SETUP messages which match the filtering criteria. The RELEASE 
and SETUP messages are matched using the call reference value, and used to trigger the 
following steps: populate the service detail record with the termination time and any 
fields relating to the reasons for termination; instruct the probe to stop monitoring for tiie 
RELEASE message; and mark the service detail record as complete, and optionally 
forward to applications servers or storage servers. 

A time-out should also be provided to terminate monitoring for the RELEASE 
message, and mark the service record as complete, if a RELEASE message is not found 
within the time-out period. 
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CLAIMS 

[30980016 WO] 

1 . A method of monitoring an ISDN link, comprising the steps of: 

monitoring at a &st location subscriber signalling messages on an ISDN D channel 
to derive first monitoring data; 

monitoring at said first location telecommunications traffic traversing ISDN B 
channels associated with said ISDN D channel to derive second monitoring data; and 

correlating said first and second monitoring data. 

2. A method according to claim 1, including the steps of: 

monitoring additional signalUng messages (e.g. SS7 protocol messages) on a 
signalling link in a telecommunications network coupled to said ISDN link, to derive third 
monitoring data; and 

correlating said third monitoring data with at least one of said first and second 

monitoring data. 

3 . A method according to claim 1 , including the steps of: 

monitoring at a second location subscriber signalling messages on an ISDN D 
channel to derive fourth monitoring data; 

monitoring at said second location telecommunications traffic traversing ISDN B 
channels associated with said ISDN D channel to derive fifth monitoring data; and 

correlating said fourth and fifth monitoring data with said first and second 
monitoring data. 

4. A method of monitoring an ISDN link, comprising the steps of: 

monitoring subscriber signaUing messages on an ISDN D channel to derive first 
monitoring data; 

monitoring additional signalling messages (e.g. SS7 protocol messages) on a 
signalling link in a telecommunications network coupled to said ISDN link, to derive second 
monitoring data; and 

correlating said first and second monitoring data. 

5. Apparatus for monitoring an ISDN link, comprising: 

fnst equipment at a first location for monitoring subscriber signalling messages on 
an ISDN D charmel to derive first monitoring data; 

second equipment at said first location for monitoring telecommunications traffic 
traversing ISDN B channels associated with said ISDN D chaxmel to derive second 
monitoring data; and 
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correlation apparatus coupled to said first and second equipment to receive and 
correlate said first and second monitoring data. 

6. Apparatus for monitoring an ISDN link, comprising: 

first equipment for monitoring subscriber signalling messages on an ISDN D channel 
to derive first monitoring data; 

second equipment for monitoring additional signalling messages (e.g, SS7 protocol 
messages) on a signalling link in a telecommunications network coupled to said ISDN link, 
to derive second monitoring data; and 

correlation apparatus coupled to said first and second equipment to receive and 
correlate said first and second monitoring data. 

7. A method of monitoring a telecommunications system having transmission channels 
and an associated signalling channel, comprising the steps of: 

monitoring at a first location signalling messages on the signalling channel to derive 

first monitoring data; 

selecting a transmission channel identified by reference to information contained in 

said first monitoring data; 

monitoring at said first location telecommunications traffic traversing the selected 
transmission channel to derive second monitoring data; and 

extracting fiirther information traversing the selected transmission channel by 
reference to information contained in said second monitoring data. 

8. The method of claim 7, wherein the transmission channel is an ISDN B channel and 
the signalling channel is an ISDN D channel. 

9. The method of claim 7, wherein the transmission channel is carried by a telephone 
transmission link and the signalling channel is carried by a common channel signalUng link, 
such as an SS7 signalling link. 

10. The method of any one of claims 7 to 9, wherein said further information comprises 
dual-tone multi-firequency (DTMF) signals. 

1 1 . The method of any one of the preceding claims, wherein monitoring for at least one 
location is passive in nature, 

12. The method of any one of the preceding claims, wherein correlation of data is 
performed to provide service records. 
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1 3 . The method of claim 1 2, wherein said service records include data derived from 
ISDN B channel. 



Q 
@ 
LU 

m 

UJ 

■01 

a 
m 



17 

ABSTRACT 
Monitoring ISDN links 

[30980016 WO] 

Telecommunications signals (voice and/or data) are provided to a subscriber via 
5 B chaimels of an Integrated Services Digital Network (ISDN) link coupled to a public 
switched telephone network (PSTN) incorporating an SS7 signalling system. A monitoring 
system extracts data from subscriber signalling messages traversing the ISDN link's D 
channel and from messages traversing the SS7 signalling system, and generates additional 
monitoring data by measuring parameters of the telecommunications signals on the B 
10 channels. These data are correlated to derive information to assist management of 
telecommunications services provided via the ISDN link. 



(Fig, 3) 
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Assistant Commissioner for Patents 
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PRELIMINARY AMENDMENT 

Dear Sir: 

Preliminary to examination, please amend the above- 
noted Application as follows: 
IN THE CLAIMS 

Amend claims 10-12 as shown below: 

10. (Amended) The method of [any one of claims] claim 
7 [to 9] , wherein said further information comprises dual- 
tone multi- frequency (DTMF) signals. 

11, (Amended) The method of [any one of the preceding 
claims] claim 1 , wherein monitoring for at least one 
location is passive in nature. 



12 , (Amended) The method of [any one of the preceding 



claims] claim 1 , wherein correlation of data is performed to 
provide service records . 



Add claims: 14-21 as follows: 

--14, The method of claim 4, wherein monitoring for at 
least one location is passive in nature. - - 

--15, The method of claim 5, wherein monitoring for at 
least one location is passive in nature, - - 

--16. The method of claim 6, wherein monitoring for at 
least one location is passive in nature, - - 

--17 e The method of claim 7, wherein monitoring for at 
least one location is passive in nature. -- 

--18. The method of claim 4, wherein correlation of 
data is performed to provide service records. 

--19. The method of claim 5, wherein correlation of 
data is performed to provide service records. -- 

--20. The method of claim 6, wherein correlation of 
data is performed to provide service records. -- 
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--21 „ The method of claim 7, wherein correlation of 
data is performed to provide service records. 
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As a below named inventor, I hereby declare that: 

My residence, post office address and citizenship are as stated below next to my name, 

I believe I am the original, first and sole inventor (if only one name is listed below) or an original, first and 
joint inventor (if plural names are listed below) of the subject matter which is claimed and for which a patent is 
sought on the invention entitled: 

Monitoring ISDN Links 



the specification of which was filed as PCT international application 

Number PCT GB98/03756 

on 15 December 1998 

and was amended under PCT Article 19 

on ( if applicable). 



I hereby state that I have reviewed and understand the contents of the above-identified specification, mcluding 
the claims, as amended by any amendment referred to above. 

I acknowledge the duty to disclose information which is material to the examination of this application in 
accordance with Tide 37, Code of Federal Regulations, ' 1.56(a). 

I hereby claim foreign priority benefits under Title 35, United States Code, ' 1 19 of any foreign application(s) 
for patent or inventor's certificate or of any PCT international application(s) designating at least one country 
other than the United States of America listed below and have also identified below any foreign application(s) 
for patent or inventor's certificate or any PCT international application(s) designating at least one country 
other than the United States of America filed by me on the same subject matter having a filmg date before that 
of die application(s) of which priority is claimed: 

PRIOR FOREIGN/PCT APPLICATION(S) AND ANY PRIORiPT CLAIMS UNDER 35 U.S.C. 119: 

COUNTRY APPLICATION NUMBER DATE OF RLtNG PRIORITY CLAIMED 

(i-f PCT indicate "PCT"J (dav- month, year] UNDER 35 USC 1 1 9 

EP 97 310 155.3 15 December 1997 _X_ Yes _ No 

EP 98 304 246.6 29 May 1998 JC^Yes _ No 



Yes No 



I hereby claim the benefit under Tide 35, United States Code, ' 120 of any United States application(s) or 
PCT international application(s) designating the United States of America that is/are listed below and, insofar 
as the subject matter of each of the claims of this application is not disclosed in that/those prior application(s) 
m the manner provided by die first paragraph of Title 35, United States Code, ' 112, I acknowledge the duty 
to disclose material information as defined in Title 37, Code of Federal Regulations, ' 1.56(a) which occurred 
between the fiimg date of the prior application(s) and the national or PCT international filing date of this 
application: 



Full name of 4th joint inventor, if any: Alistair Scott Reynolds 

Inventor's Signature: ^^^^ Ly^OU ^ Datej: 

Residence: Linlithgow, Scotland, GB 

Citizenship : British 

Post Office Address: 46A Mains Road, Linlithgow, EH49 6QA, Scotland, GB 



COMBINED DECLARATION FOR PATENT APPLICATION & POWER OF ATTORNEY (Continued) 

(Includes Reference to PCT International Applications) 



PRIOR U.S. APPLICATIONS OR PCT INTERNATIONAL APPLICATIONS DESIGNATING THE U.S. FOR BENEFIT UNDER 35 U.S.C. 
120: 



U.S. APPLICATiONS 

U S. APPLICATION NUMBER U.S. FILING DATE 



STATUS (Check one) 

PATENTED PENDING ABANDONED 



PCT APPLICATIONS DESIGNATING THE U.S. 
PCT APPLICATION NO. PCT FILING DATE U S SERIAL NUMBERS 

ASSIGNED (if any} 



POWER OF ATTORNEY: As a named inventor, I hereby appoint flie following attomey(s) and/or agent(s) 
to prosecute this application and transact all business in the Patent and Trademark Office connected therewith. 



David Koffsky, Reg. No. 19,905^ 



/ 



SEND CORRESPONDENCE TO: 

David Koffsky, do Ohiandt, Greeley, Ruggjgr o.&.Pei]g, 

Suite 903, One Landmark Square 

Stamford. CT 06901 



DIRECT TELEPHONE CALLS TO: 
David Koffsky, (203)-327-4500 



I hereby declare that all statements made herein of my own knowledge are true and that all statements made on 
information and belief are believed to be true; and further that these statements were made with the 
knowledge that willful false statements and the like so made are punishable by fine or imprisonment, or both, 
under Section 1001 of Title 18 of the United States Code, and that such willful false statements may jeopardize 
the validity of the application or any patent issued thereon. 



Full name of sole or first inventor: Peter Jo hn Mottishaw 

Inventor's Signature: 



Dated: 



Residence: South Queensferry, WesU^flu^^ GB ^ 

Citizenship: British 

Post Office Address: 60 Stoneyflatts, South- Queensferry, West Lothian EH30 9XU, Scotland, GB 



Dated: 



Full name of 2nd joint inventor, if anv:^JD avid Moir Archibald 
2^ Inventor's Sig-^mre: 1^ 

Residence: Dalkeith, Midlothian. Scotl and. GB (^l^h^ 

Citizenship: British 

Post Office Address: 1 Cortleferry Park,Dalkeifli, Midlothian EH22 3HT, Scotland, GB 



Full name of 3rd joint inventor, if any: Dougl as John Carson 
^ rr\ hiventor's Signature: 

9 



Dated: 



Residence 
Citizenship: 



Edinburgh, S cofland, GB 
British 

Post Office Address: 6/8 Russell Gardens, Rosebum, Edinburgh EH12 5PG, Scotland, GB 



{ ^ Full flame of 4th joint ii^entor, if any: Alistair Scott Reynolds 

iDveritor's Signature: ' ' Dated: 

Residence: Linlithgow, Scotland, G^^iS/^vA.^ 

Citizenship: British Cl^f--^ 

Post Office Address: 46A Mains Road, Linlithgow, EH49 6QA, Scotland, GB 
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